diff --git a/clients/web/src/test/core/auth/cimd.test.ts b/clients/web/src/test/core/auth/cimd.test.ts index 15aebd40..2eac1395 100644 --- a/clients/web/src/test/core/auth/cimd.test.ts +++ b/clients/web/src/test/core/auth/cimd.test.ts @@ -24,6 +24,9 @@ describe("ensureCimdClientRegistration", () => { storage = { getClientInformation: vi.fn(async () => undefined), saveClientInformation: vi.fn(async () => {}), + getDiscoveryState: vi.fn(async () => undefined), + getCimdClientMetadataUrl: vi.fn(async () => undefined), + saveCimdClientMetadataUrl: vi.fn(async () => {}), getScope: vi.fn().mockResolvedValue(undefined), getTokens: vi.fn(async () => undefined), saveTokens: vi.fn(async () => {}), @@ -72,6 +75,12 @@ describe("ensureCimdClientRegistration", () => { }, { registrationKind: "cimd", issuer: "http://127.0.0.1:9999" }, ); + // The provenance marker for this AS, which outlives the credential. + expect(storage.saveCimdClientMetadataUrl).toHaveBeenCalledWith( + SERVER_URL, + "http://127.0.0.1:9999", + METADATA_URL, + ); }); it("does not register when the AS metadata omits CIMD support", async () => { @@ -102,6 +111,13 @@ describe("ensureCimdClientRegistration", () => { }); expect(storage.saveClientInformation).not.toHaveBeenCalled(); + // The marker is actively withdrawn, not merely left unwritten, so an AS that + // stops advertising CIMD stops being treated as one. + expect(storage.saveCimdClientMetadataUrl).toHaveBeenCalledWith( + SERVER_URL, + "http://127.0.0.1:9999", + undefined, + ); }); it("discovers protected-resource metadata at the challenge-advertised URL (#2071)", async () => { @@ -161,6 +177,57 @@ describe("ensureCimdClientRegistration", () => { ); }); + // #2242 (Copilot): the existing-client check moved after discovery, so this + // helper must not turn a well-known outage into a failed reconnect. It reuses + // the discovery state SDK `auth()` persists, and treats a discovery failure as + // "skip pre-registration" rather than an error. + it("reuses persisted discovery state instead of re-fetching", async () => { + storage.getDiscoveryState = vi.fn(async () => ({ + authorizationServerUrl: "http://127.0.0.1:9999", + authorizationServerMetadata: { + issuer: "http://127.0.0.1:9999", + authorization_endpoint: "http://127.0.0.1:9999/oauth/authorize", + token_endpoint: "http://127.0.0.1:9999/oauth/token", + response_types_supported: ["code"], + client_id_metadata_document_supported: true, + }, + })); + const fetchFn = vi.fn(async () => { + throw new Error("discovery must not run when state is cached"); + }); + + await ensureCimdClientRegistration({ + serverUrl: SERVER_URL, + provider: createProvider(storage), + fetchFn, + }); + + expect(fetchFn).not.toHaveBeenCalled(); + expect(storage.saveClientInformation).toHaveBeenCalledWith( + SERVER_URL, + { client_id: METADATA_URL }, + { registrationKind: "cimd", issuer: "http://127.0.0.1:9999" }, + ); + }); + + it("skips pre-registration when discovery fails, rather than throwing", async () => { + const fetchFn = vi.fn(async () => { + throw new Error("well-known endpoint is down"); + }); + + await expect( + ensureCimdClientRegistration({ + serverUrl: SERVER_URL, + provider: createProvider(storage), + fetchFn, + }), + ).resolves.toBeUndefined(); + + expect(storage.saveClientInformation).not.toHaveBeenCalled(); + // No marker is invented either — nothing was learned about the AS. + expect(storage.saveCimdClientMetadataUrl).not.toHaveBeenCalled(); + }); + it("no-ops when client information is already stored for the discovered issuer", async () => { // Dynamic slot only — a preregistered hit would short-circuit // `clientInformation()` before it ever reaches the issuer-keyed read. diff --git a/clients/web/src/test/core/auth/connection-state.test.ts b/clients/web/src/test/core/auth/connection-state.test.ts index d328b01b..44a07110 100644 --- a/clients/web/src/test/core/auth/connection-state.test.ts +++ b/clients/web/src/test/core/auth/connection-state.test.ts @@ -61,6 +61,8 @@ function createStorage( getCodeVerifier: vi.fn(), getDiscoveryState: vi.fn().mockResolvedValue(undefined), saveDiscoveryState: vi.fn(), + getCimdClientMetadataUrl: vi.fn(async () => undefined), + saveCimdClientMetadataUrl: vi.fn(async () => undefined), clearDiscoveryState: vi.fn(), }; } diff --git a/clients/web/src/test/core/auth/providers.test.ts b/clients/web/src/test/core/auth/providers.test.ts index c560b5cc..90dbc853 100644 --- a/clients/web/src/test/core/auth/providers.test.ts +++ b/clients/web/src/test/core/auth/providers.test.ts @@ -221,6 +221,8 @@ describe("OAuthNavigation", () => { getScope: vi.fn().mockResolvedValue(undefined), getClientInformation: vi.fn(async () => undefined), getClientRegistrationKind: vi.fn(async () => undefined), + getCimdClientMetadataUrl: vi.fn(async () => undefined), + saveCimdClientMetadataUrl: vi.fn(async () => undefined), saveClientInformation: vi.fn(async () => undefined), savePreregisteredClientInformation: vi.fn(async () => undefined), saveScope: vi.fn(async () => undefined), @@ -641,20 +643,16 @@ describe("OAuthNavigation", () => { const ISSUER = "https://as.example.com"; const METADATA_URL = "https://app.example.com/client-metadata.json"; - /** Storage already holding the CIMD pre-registration for METADATA_URL. */ + /** Storage holding this AS's CIMD marker for METADATA_URL. */ function makeCimdStorage(): OAuthStorage { const storage = makeStorage(); - vi.mocked(storage.getClientInformation).mockImplementation( - async (_url: string, preregistered?: boolean) => - preregistered ? undefined : { client_id: METADATA_URL }, - ); - vi.mocked(storage.getClientRegistrationKind).mockResolvedValue( - "cimd", + vi.mocked(storage.getCimdClientMetadataUrl).mockResolvedValue( + METADATA_URL, ); return storage; } - it("keeps cimd when CIMD is configured and the stored registration matches", async () => { + it("keeps cimd when CIMD is configured and this issuer carries the marker", async () => { const storage = makeCimdStorage(); const provider = makeProvider(storage, vi.fn(), { clientMetadataUrl: METADATA_URL, @@ -665,11 +663,8 @@ describe("OAuthNavigation", () => { { issuer: ISSUER }, ); - // Reads the dynamic slot for this issuer, which falls back to the - // unkeyed slot the pre-registration wrote. - expect(storage.getClientInformation).toHaveBeenCalledWith( + expect(storage.getCimdClientMetadataUrl).toHaveBeenCalledWith( SERVER, - false, ISSUER, ); expect(storage.saveClientInformation).toHaveBeenCalledWith( @@ -679,6 +674,31 @@ describe("OAuthNavigation", () => { ); }); + // SDK v2 `auth()` answers `invalid_client` / `unauthorized_client` with + // `invalidateCredentials("client")` and an immediate retry. That clears + // the stored registration *and* its kind, so provenance read off the + // credential would be gone by the time the retry's CIMD save lands + // (Copilot). The marker is not a credential and survives. + it("keeps cimd through invalid-client recovery, which clears the credential", async () => { + const storage = makeCimdStorage(); + const provider = makeProvider(storage, vi.fn(), { + clientMetadataUrl: METADATA_URL, + }); + + await provider.invalidateCredentials("client"); + await provider.saveClientInformation( + { client_id: METADATA_URL }, + { issuer: ISSUER }, + ); + + expect(storage.clearClientInformation).toHaveBeenCalledWith(SERVER); + expect(storage.saveClientInformation).toHaveBeenCalledWith( + SERVER, + { client_id: METADATA_URL }, + { registrationKind: "cimd", issuer: ISSUER }, + ); + }); + it("records dcr for a server-minted client_id while CIMD is configured", async () => { const storage = makeCimdStorage(); const provider = makeProvider(storage, vi.fn(), { @@ -690,10 +710,8 @@ describe("OAuthNavigation", () => { { issuer: ISSUER }, ); - // The id is not the metadata URL, so nothing is read and nothing is - // carried forward. - expect(storage.getClientInformation).not.toHaveBeenCalled(); - expect(storage.getClientRegistrationKind).not.toHaveBeenCalled(); + // The id is not the metadata URL, so the marker is never consulted. + expect(storage.getCimdClientMetadataUrl).not.toHaveBeenCalled(); expect(storage.saveClientInformation).toHaveBeenCalledWith( SERVER, { client_id: "dcr-minted-id" }, @@ -701,7 +719,7 @@ describe("OAuthNavigation", () => { ); }); - it("records dcr when CIMD is not configured, even if storage says cimd", async () => { + it("records dcr when CIMD is not configured, even if the marker is set", async () => { const storage = makeCimdStorage(); const provider = makeProvider(storage); @@ -717,29 +735,11 @@ describe("OAuthNavigation", () => { ); }); - it("records dcr when the metadata URL differs from the configured one", async () => { - const storage = makeCimdStorage(); - const provider = makeProvider(storage, vi.fn(), { - clientMetadataUrl: "https://other.example.com/client-metadata.json", - }); - - await provider.saveClientInformation( - { client_id: METADATA_URL }, - { issuer: ISSUER }, - ); - - expect(storage.saveClientInformation).toHaveBeenCalledWith( - SERVER, - { client_id: METADATA_URL }, - { registrationKind: "dcr", issuer: ISSUER }, - ); - }); - - it("records dcr when no CIMD registration was ever stored", async () => { - // The AS returns the configured metadata URL from a real registration - // (RFC 7591 §3.2 leaves the id opaque). With nothing recorded as CIMD - // under that id, the save is still DCR. + it("records dcr when the marker names a different metadata URL", async () => { const storage = makeStorage(); + vi.mocked(storage.getCimdClientMetadataUrl).mockResolvedValue( + "https://other.example.com/client-metadata.json", + ); const provider = makeProvider(storage, vi.fn(), { clientMetadataUrl: METADATA_URL, }); @@ -756,13 +756,11 @@ describe("OAuthNavigation", () => { ); }); - it("records dcr when the stored kind under that id is not cimd", async () => { + it("records dcr when this issuer carries no marker", async () => { + // The AS returns the configured metadata URL from a real registration + // (RFC 7591 §3.2 leaves the id opaque). With no marker for this AS, + // the save is still DCR. const storage = makeStorage(); - vi.mocked(storage.getClientInformation).mockImplementation( - async (_url: string, preregistered?: boolean) => - preregistered ? undefined : { client_id: METADATA_URL }, - ); - vi.mocked(storage.getClientRegistrationKind).mockResolvedValue("dcr"); const provider = makeProvider(storage, vi.fn(), { clientMetadataUrl: METADATA_URL, }); @@ -802,8 +800,8 @@ describe("OAuthNavigation", () => { * has to name the AS, so that the RFC 8414 §3.3 issuer echo the SDK * enforces resolves against the AS URL rather than the resource's. */ - function discoveryFetch(issuer: string, cimd: boolean) { - return (async (input: RequestInfo | URL) => { + function discoveryFetch(issuer: string, cimd: boolean): typeof fetch { + return async (input: RequestInfo | URL) => { const url = String(input); if (url.includes("/.well-known/oauth-protected-resource")) { return new Response( @@ -827,7 +825,7 @@ describe("OAuthNavigation", () => { ); } throw new Error(`unexpected fetch: ${url}`); - }) as unknown as typeof fetch; + }; } /** Issuer A pre-registers via CIMD, then the SDK binds it. */ @@ -900,6 +898,43 @@ describe("OAuthNavigation", () => { ).toBe("cimd"); }); + // The provenance marker's whole reason for existing: SDK v2 `auth()` + // answers `invalid_client` with `invalidateCredentials("client")` and + // an immediate retry, and that clear removes the credential *and* its + // registration kind. Asserted against real storage, since the point is + // what `clearClientInformation` does and does not touch (Copilot). + it("keeps the CIMD marker through invalid-client credential invalidation", async () => { + const storage = makeRealStorage(); + const provider = await bindIssuerA(storage); + expect(await storage.getCimdClientMetadataUrl(SERVER, ISSUER)).toBe( + METADATA_URL, + ); + + await provider.invalidateCredentials("client"); + + // The credential and its kind are gone... + expect( + await storage.getClientInformation(SERVER, false, ISSUER), + ).toBeUndefined(); + expect( + await storage.getClientRegistrationKind(SERVER, ISSUER), + ).toBeUndefined(); + // ...but the marker is not a credential, so it survives. + expect(await storage.getCimdClientMetadataUrl(SERVER, ISSUER)).toBe( + METADATA_URL, + ); + + // The SDK's retry re-runs its URL-based client-ID branch. + await provider.saveClientInformation( + { client_id: METADATA_URL }, + { issuer: ISSUER }, + ); + + expect( + await storage.getClientRegistrationKind(SERVER, ISSUER), + ).toBe("cimd"); + }); + it("records dcr for a second issuer that mints its own client_id", async () => { const storage = makeRealStorage(); const provider = await bindIssuerA(storage); diff --git a/clients/web/src/test/core/mcp/oauthManager.test.ts b/clients/web/src/test/core/mcp/oauthManager.test.ts index 96d1df80..1da62370 100644 --- a/clients/web/src/test/core/mcp/oauthManager.test.ts +++ b/clients/web/src/test/core/mcp/oauthManager.test.ts @@ -70,6 +70,8 @@ function createMockParams( takeRevocationSnapshot: vi.fn().mockResolvedValue({ byIssuer: {} }), getDiscoveryState: vi.fn().mockResolvedValue(undefined), saveDiscoveryState: vi.fn().mockResolvedValue(undefined), + getCimdClientMetadataUrl: vi.fn(async () => undefined), + saveCimdClientMetadataUrl: vi.fn(async () => undefined), clearDiscoveryState: vi.fn().mockResolvedValue(undefined), }; diff --git a/core/auth/cimd.ts b/core/auth/cimd.ts index 5074f37c..c50365ee 100644 --- a/core/auth/cimd.ts +++ b/core/auth/cimd.ts @@ -27,50 +27,69 @@ export async function ensureCimdClientRegistration(params: { const clientMetadataUrl = params.provider.clientMetadataUrl?.trim(); if (!clientMetadataUrl) return; - let resourceMetadata; - try { - resourceMetadata = await discoverOAuthProtectedResourceMetadata( - params.serverUrl, - { resourceMetadataUrl: params.resourceMetadataUrl }, - // The same fetch the AS-metadata leg below uses. On web that is - // `createRemoteFetch`, which proxies through the backend to sidestep - // CORS — on the global `fetch` this leg would fail in the browser, be - // swallowed by the catch, and leave CIMD probing the wrong - // authorization server (Copilot). - params.fetchFn, + // Prefer the discovery state SDK `auth()` itself persists and reuses. Without + // this, moving the existing-client check after discovery would turn a + // temporary well-known outage into a failed reconnect, even where the SDK + // could have proceeded from cache (Copilot). + let metadata = (await params.provider.discoveryState()) + ?.authorizationServerMetadata; + + if (!metadata) { + let resourceMetadata; + try { + resourceMetadata = await discoverOAuthProtectedResourceMetadata( + params.serverUrl, + { resourceMetadataUrl: params.resourceMetadataUrl }, + // The same fetch the AS-metadata leg below uses. On web that is + // `createRemoteFetch`, which proxies through the backend to sidestep + // CORS — on the global `fetch` this leg would fail in the browser, be + // swallowed by the catch, and leave CIMD probing the wrong + // authorization server (Copilot). + params.fetchFn, + ); + } catch { + resourceMetadata = undefined; + } + + try { + // Walks the path-scoped authorization-server URL before the bare origin, so + // a server hosted under a path is probed where it actually publishes its + // metadata rather than only at the domain root (#2110). + metadata = await discoverAuthorizationServerMetadataForServer( + params.serverUrl, + resourceMetadata, + params.fetchFn, + ); + } catch { + // Pre-registration is an optimization over what SDK `auth()` does for + // itself, so a discovery failure here must never fail the connection: bail + // out and let `auth()` run its own discovery and error handling. + return; + } + } + + const issuer = metadata?.issuer; + + // Record — or withdraw — this AS's CIMD marker before anything else, so it + // stays current rather than only ever being written once. It is keyed by + // issuer and is not a credential, so `invalidateCredentials("client")` leaves + // it alone; see `IssuerBoundOAuthState.cimdClientMetadataUrl`. + if (issuer) { + await params.provider.saveCimdClientMetadataUrl( + issuer, + metadata?.client_id_metadata_document_supported + ? clientMetadataUrl + : undefined, ); - } catch { - resourceMetadata = undefined; } - // Walks the path-scoped authorization-server URL before the bare origin, so a - // server hosted under a path is probed where it actually publishes its - // metadata rather than only at the domain root (#2110). - const metadata = await discoverAuthorizationServerMetadataForServer( - params.serverUrl, - resourceMetadata, - params.fetchFn, - ); if (!metadata?.client_id_metadata_document_supported) return; - // SEP-2352 keys a registration to the authorization server that issued it, so - // the record this writes is bound to the issuer we just discovered rather than - // to the server as a whole. That binding is what makes the provenance - // trustworthy later: `BaseOAuthClientProvider.saveClientInformation` preserves - // `cimd` only for an issuer this function recorded it for, having first - // confirmed *that* AS advertises `client_id_metadata_document_supported` - // (#2242, Copilot). A second AS behind the same resource therefore gets its own - // determination — pre-registered here when it too supports CIMD, and left to - // dynamic registration when it does not. - // - // ⚠️ This is why the "do we already have a client?" check below sits *after* - // discovery rather than short-circuiting it, at the cost of a discovery round - // trip on each connect attempt rather than only the first. Read ctx-less — as - // it was — it resolves through the *active* issuer and so early-returns for - // every subsequent issuer, leaving them with no CIMD record at all. It still + // ⚠️ Keyed by the issuer just resolved, not read ctx-less. A ctx-less read + // resolves through the *active* issuer, so it early-returns for every + // subsequent issuer and leaves them with no CIMD record at all. It still // answers the static case first, since `clientInformation` checks the // preregistered slot before any issuer slot. - const issuer = metadata.issuer; const existing = await params.provider.clientInformation( issuer ? { issuer } : undefined, ); diff --git a/core/auth/oauth-storage.ts b/core/auth/oauth-storage.ts index 68b7810c..26f76f39 100644 --- a/core/auth/oauth-storage.ts +++ b/core/auth/oauth-storage.ts @@ -186,6 +186,34 @@ export class OAuthStorageBase implements OAuthStorage { ); } + async getCimdClientMetadataUrl( + serverUrl: string, + issuer?: string, + ): Promise { + await this.ensureLoaded(); + const state = this.memory.getState().getServerState(serverUrl); + return this.issuerSlot(state, issuer)?.cimdClientMetadataUrl; + } + + async saveCimdClientMetadataUrl( + serverUrl: string, + issuer: string, + clientMetadataUrl: string | undefined, + ): Promise { + await this.ensureLoaded(); + // Not a save of credentials, so it must not promote this issuer to + // `activeIssuer` — the marker is written during discovery, before anything + // has been authorized against this AS. + this.updateIssuerSlot( + serverUrl, + issuer, + { cimdClientMetadataUrl: clientMetadataUrl }, + {}, + false, + ); + await this.persist(); + } + async saveClientInformation( serverUrl: string, clientInformation: OAuthClientInformation, diff --git a/core/auth/providers.ts b/core/auth/providers.ts index 73ec1acc..d6225643 100644 --- a/core/auth/providers.ts +++ b/core/auth/providers.ts @@ -321,38 +321,35 @@ export class BaseOAuthClientProvider implements OAuthClientProvider { * Connection Info the moment the SDK bound it to an issuer (#2242). * * The claim is deliberately narrow — three conditions must all hold, and the - * decisive one is a registration *we ourselves recorded* as CIMD, not an - * inference about what the authorization server returned: + * decisive one is a fact *we recorded about this authorization server*, not an + * inference about what it returned: * * 1. CIMD is configured for this connection right now, and * 2. the incoming `client_id` is exactly that metadata-document URL, and - * 3. the registration stored **for this issuer** under that same `client_id` - * is recorded as `cimd` — written by `ensureCimdClientRegistration`, which - * reaches that line only after confirming *that* AS advertises - * `client_id_metadata_document_supported`. + * 3. `ensureCimdClientRegistration` recorded that same URL as the CIMD marker + * **for this issuer**, having read `client_id_metadata_document_supported` + * from *that* AS's own metadata. * * RFC 7591 §3.2 makes a dynamically issued `client_id` opaque, so a client may * not assume its format — which is why (2) is not load-bearing on its own. For * a `registerClient` result to be mislabeled here, the AS would have to mint an - * identifier byte-identical to the HTTPS URL we configured *and* be an AS we - * had already recorded a CIMD registration for — that is, one that advertises - * CIMD and then dynamically registers anyway. Anything else — a fresh DCR, a - * different id, CIMD switched off, no prior CIMD registration for this issuer — - * falls through to `"dcr"`. + * identifier byte-identical to the HTTPS URL we configured *and* be an AS that + * currently advertises CIMD and dynamically registered anyway. Anything else — + * a fresh DCR, a different id, CIMD switched off, an AS that does not advertise + * CIMD — falls through to `"dcr"`. * - * ⚠️ (3) is scoped to the issuer on purpose, and the lookup deliberately does - * **not** fall back to the server's active issuer. SEP-2352 keys registrations - * per AS, so a second AS behind the same resource is a separate determination: - * it may well not support CIMD and register dynamically, and RFC 7591 permits - * it to mint the very URL the first AS uses as a CIMD `client_id` (Copilot). - * `ensureCimdClientRegistration` binds the record to the issuer it discovered, - * which is what lets this stay issuer-scoped without losing a genuine - * second-issuer CIMD registration. + * ⚠️ (3) reads the **marker**, not the stored registration kind, and the two + * differ in exactly one place that matters: `invalidateCredentials("client")` + * clears the credential and its kind, and SDK v2 `auth()` calls it on an + * `invalid_client` / `unauthorized_client` response before retrying. The + * retry's URL-based client-ID save would then find no kind and be recorded as + * DCR. The marker describes the AS rather than the credential, so it survives + * that clear (#2242, Copilot). * - * The read is still issuer-*keyed* rather than issuer-*only*: `getClientInformation` - * falls back to the unkeyed slot when no `byIssuer` entry exists, which is how a - * pre-registration written before an issuer was known is still found on the save - * that first binds one. + * ⚠️ (3) is issuer-scoped with no fallback to the server's active issuer. A + * second AS behind one resource is a separate determination: it may not support + * CIMD and may register dynamically, and RFC 7591 permits it to mint the very + * URL the first AS uses as its CIMD `client_id`. */ private async resolveSdkRegistrationKind( clientInformation: OAuthClientInformation, @@ -365,19 +362,28 @@ export class BaseOAuthClientProvider implements OAuthClientProvider { ) { return "dcr"; } - const stored = await this.storage.getClientInformation( - this.serverUrl, - false, - issuer, - ); - if (stored?.client_id !== clientMetadataUrl) return "dcr"; - const storedKind = await this.storage.getClientRegistrationKind( + const marker = await this.storage.getCimdClientMetadataUrl( this.serverUrl, issuer, ); - // `"static"` lives in the preregistered slot, never this one, so `"cimd"` - // is the only kind worth carrying forward. - return storedKind === "cimd" ? "cimd" : "dcr"; + return marker === clientMetadataUrl ? "cimd" : "dcr"; + } + + /** @see OAuthStorage.getCimdClientMetadataUrl */ + async cimdClientMetadataUrl(issuer?: string): Promise { + return await this.storage.getCimdClientMetadataUrl(this.serverUrl, issuer); + } + + /** @see OAuthStorage.saveCimdClientMetadataUrl */ + async saveCimdClientMetadataUrl( + issuer: string, + clientMetadataUrl: string | undefined, + ): Promise { + await this.storage.saveCimdClientMetadataUrl( + this.serverUrl, + issuer, + clientMetadataUrl, + ); } async saveScope(scope: string | undefined): Promise { diff --git a/core/auth/storage.ts b/core/auth/storage.ts index edc6451e..559f118d 100644 --- a/core/auth/storage.ts +++ b/core/auth/storage.ts @@ -81,6 +81,23 @@ export interface OAuthStorage { issuer?: string, ): Promise; + /** + * The CIMD client-metadata URL this authorization server was confirmed to + * accept as a `client_id`. Survives {@link clearClientInformation}, because it + * records a property of the AS rather than a credential (#2242). + */ + getCimdClientMetadataUrl( + serverUrl: string, + issuer?: string, + ): Promise; + + /** Write (or, with `undefined`, clear) the marker above for one issuer. */ + saveCimdClientMetadataUrl( + serverUrl: string, + issuer: string, + clientMetadataUrl: string | undefined, + ): Promise; + /** * Save client information (dynamically registered) */ diff --git a/core/auth/store.ts b/core/auth/store.ts index d5e13511..6243600c 100644 --- a/core/auth/store.ts +++ b/core/auth/store.ts @@ -30,6 +30,21 @@ export interface IssuerBoundOAuthState { /** Set when {@link clientInformation} is saved — DCR vs CIMD. */ clientRegistrationKind?: OAuthClientRegistrationKind; tokens?: OAuthTokens; + /** + * The CIMD client-metadata URL this AS was confirmed to accept as a `client_id` + * — written by `ensureCimdClientRegistration` after reading + * `client_id_metadata_document_supported` from *this* issuer's metadata, and + * refreshed (or cleared) on every connect because that check now runs each time. + * + * Deliberately **not** a credential, and so deliberately **not** cleared by + * {@link OAuthStorage.clearClientInformation}. It records a property of the + * authorization server and our own configuration, which an `invalid_client` + * response says nothing about: SDK v2 `auth()` answers that error by calling + * `invalidateCredentials("client")` and retrying, and the retry's URL-based + * client-ID save would otherwise land with no provenance and be recorded as + * DCR (#2242, Copilot). + */ + cimdClientMetadataUrl?: string; } /**